CVE-2026-33578
CRITICAL
NVD
CVSS Score
9.8
Severity
CRITICAL
Published
Mar 31, 2026
Vendor
unknown
Description
OpenClaw before 2026.3.28 contains a sender policy bypass vulnerability in the Google Chat and Zalouser extensions where route-level group allowlist policies silently downgrade to open policy. Attackers can exploit this policy resolution flaw to bypass sender restrictions and interact with bots despite configured allowlist restrictions.